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ABSTRACT OF THE DISCLOSURE 

Methods and apparatus for collecting, storing, 
processing and using data, such a RM0N2 network traffic 
data, are described. Network traffic probes are 
identified and attempts are made to configure the 
5 identified probes to generate network traffic data sets 

which are as close to a preselected common data format as 
possible. Application layer traffic data is collected in 
addition to network layer traffic data when possible. In 
an RM0N2 embodiment, the common data format includes the 

10 use of delta count values as opposed to absolute count 

values. The common data format of the present invention 
utilizes terminal count mode format as opposed to all 
count mode format for the presentation of RM0N2 
application layer information. To minimize the amount of 

15 data processing required to put a probe's network traffic 

data into the desired common format and to maximize the 
amount of information collected, network data is obtained 
from a probe using one of the available RMON2 table 
formats. - Th e— utilis e d - f u iiUciL is selected -in thp 

Mode)- , — alMatrixTopN (A - I - lModc) , alMatrix, nlMa - t - rixTopN a - n -d 
n - lMa - trix . In order to avoid various problems with known 
data aging processes used to limit the growth of network 
traffic databases, a database of collected network 
25 traffic information which includes multiple parallel sets 

of data stored at different resolutions is created and 
maintained. The data sets for each individual resolution 
are stored in a separate FIFO data structure and with the 
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oldest data records in the FIFO being overwritten when 
allocated data space becomes fully utilized. 
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